Since your internal ACL matches what you were using in
"allow-recursion", just change the "allow-recursion" in global options
to "recursion no;" and allow the view based "recursion yes;" (internal)
and "recursion no;" (external) to override it.

Note that !0.0.0.0 ("none") is added to every ACL expansion, so you
don't need it in the example above.

Just for good measure, you may want to change the external match-clients to: